Progressive sharing of an image

Progressive sharing of an image

Kuo-Hsien Hung Yu-Jie Chang Ja-Chen Lin

Department of Computer Science National Chiao Tung University Hsinchu, 300, Taiwan

E-mail: yjchang@cis.nctu.edu.tw

Abstract. We propose a sharing method to progressively reveal a given important image in the recovery phase. In the encoding phase, the dis-tributor utilizes the three frequency bands共low, middle, and high兲 of the given image to generate shadows according to three prespecified thresholds. In the recovery phase, the secret image cannot be revealed if the number of shadows a team collects is less than the lowest thresh-old. However, when the number of collected shadows reaches the pre-specified low共or middle- or high兲 threshold, the team can reconstruct a low-共or middle- or high-兲 quality version of the secret image. In other words, the quality of the reconstructed image depends only on the num-ber of shadows being received, rather than on which of the generated shadows are received. Each noise-like shadow is so small that it can be hidden in an ordinary image that is still several times smaller than the original image. © 2008 Society of Photo-Optical Instrumentation Engineers. 关DOI: 10.1117/1.2911719兴

Subject terms: discrete cosine transform 共DCT兲; hiding; sharing; progressive reconstruction; small-size stego images.

Paper 070625R received Jul. 28, 2007; revised manuscript received Dec. 11, 2007; accepted for publication Dec. 31, 2007; published online Apr. 29, 2008.

1 Motivation and Goals

Confidential or sensitive images often exist in industrial, commercial, medical, and military applications. Security about the transmission and storage of these images can be done using cryptography techniques.1–5The data encryption standard共DES兲1and the RSA method共Rivest, Shamir, and Adleman兲2are two famous key-based methods. The secret image is first encrypted using a predetermined key; the re-sulting image is called a cipherimage. Trying to decode the cipherimage would be extremely hard for unauthorized people unless they steal the encryption key. Therefore, the concern then becomes how to protect the secret key. Shamir3and Blakley4presented the idea of secret sharing, which could also be utilized to increase the safety level of key safeguarding. Their sharing system is an共r,n兲 thresh-old scheme, where rⱕn, that divides 共not duplicates兲 the secret key into n shadows.The共r,n兲 threshold scheme has a criterion: Using r or more shadows can recover the secret key, while using r − 1 or fewer shadows cannot. After shar-ing the secret key and generatshar-ing shadows, these shadows are distributed to n locations for safekeeping. The scheme will ensure the safety of key, even if r − 1 shadows are stolen by an identical hacker. Therefore, a simple way to protect a confidential image might be to encrypt the image using a key and then share that key and store the key’s shadows in different places. This kind of protection still has a weakness: The loss or damage of the cipherimage itself 共the encrypted version of the confidential image兲 means that the original image is gone forever, even if we have all shadows of the key. Thien and Lin6 thus share the secret image itself using an共r,n兲 threshold scheme for an image. In Ref. 6, the secret image is shared among n partici-pants, and each participant holds a 共noise-like兲 shadow

image. Any r participants can cooperate to reconstruct the secret image, while r − 1 or fewer participants cannot. The size of each shadow image is r times smaller than that of the secret image; therefore, if most of the communication channels are in good condition, the communication time needed to transmit r shadow images from r distributed sites to an assigned destination for recovery of the secret image will not be too long共as compared with the time needed to transmit the original big-size secret image to the destina-tion兲.

Notably, in the secret image-sharing method,6the recov-ery result cannot be viewed progressively. However, this was okay because the images discussed in Ref. 6 are all top-secret images, and hence the inverse-sharing output is either completely recovered or nothing but noise. However, in the real world, not every important thing is top-secret. There are some images that are a little sensitive but still need to be processed every day. For example, the owner of a company may not want any employees to sell good-quality, sensitive pictures or blueprints on the black market, yet the owner still wants the employees to cooperate on an everyday basis in order to improve the design shown in the blueprints, or to safeguard the people shown in the pictures. With our new design here, the boss can keep 3 of the 6 generated shadows共using Figs.4and5as an example兲, and each of his 3 employees can have one of the remaining 6 − 3 = 3 shadows. Each day, the three employees can coop-erate. If the employees want to take a closer view, then they have to ask the boss to give them support. The boss can lend them more shadows to increase the picture’s clarity progressively. If, for some reason, one of the employees is absent or runs away with his shadow, then the remaining employees can still ask the boss for help. The boss can lend the incomplete team either one more shadow to show the picture blurrily or two or three more shadows to provide a much better look.

Another example is that, in real life, the channels con-necting the shadows’ distributed storage sites and the com-mon meeting place for image recovery is sometimes un-stable due to connection delay, error, complete failure of a channel or a storage site, or a long transmission over narrow-bandwidth network channels. When an authorized person or group tries to recover an image, the shadows collecting from several locations on the Internet may not arrive at the same time. As a result, the decoding post may not receive many shadows instantly, while the authorized person or group is eager to know what the image looks like. Again, progressive reconstruction through the available shadows is useful here 共which is somehow different from the commonly seen progressive image transmission methods7–9because any of our generated shadows could be the missing shadow兲. We therefore wish to propose in this paper a progressive-viewing method to share the images. Notably, since each shadow image looks noisy, an attack from hackers is likely. Therefore, our n generated shadows are hidden in n cover images to form n stego images, which look ordinary instead of being noisy, to avoid attracting the hacker’s attention. We also wish that the size of each ordinary-looking stego image 共containing a noise-like shadow image hidden inside兲 be still much smaller than that of the original secret image. This cannot only keep the storage space and transmission time economic, but can also increase the chance that the receiver can view the secret image 共when each communication channel can only be stable for a very short time兲.

Therefore, our goal is to design a progressive sharing method whose stego images are small. The rest of this pa-per is organized as follows. Sec. 2 reviews the secret-sharing method briefly. Sec. 3 describes the encoding, while Sec. 4 introduces the decoding 共the reconstruction phase兲. Experimental results and security analysis of shad-ows are detailed in Sec. 5. A discussion appears in Sec. 6, while conclusions are given in Sec. 7.

2 A Review of Secret-Sharing Methods

The concept of secret sharing was introduced indepen-dently by Shamir3 and Blakley.4 Their 共r, n兲 threshold scheme divides a secret numerical value into n shares, and any r shares can recover the secret numerical value. Several secret-sharing methods based on their 共r, n兲 threshold scheme have been proposed.6,10–17Among them, Thien and Lin6proposed an共r, n兲 sharing scheme particularly for se-cret images. The sese-cret image was shared among n partici-pants, and each participant held a generated shadow image whose size was only 1/r that of the secret image. The smaller size of their shadow images 共r times smaller than the shadow images created by ordinary sharing methods兲 is an advantage in the transmission and storage. They further developed a method in Ref.12 that made the shadow im-ages look like portraits of the original secret image, and thus provided a user-friendly interface to facilitate the man-agement of the shadow images. Extensions of Shamir’s masterpiece3 to combine with visual cryptography5 can be found in Refs.15and16. Wang and Shyu17also proposed a scalable secret image-sharing scheme to increase the appli-cations of the secret image-sharing scheme.6 But the method is still not a progressive one. As for the method in the frequency domain, Lin and Tsai13 mapped the secret

image into the frequency domain and then utilized a se-quence of random numbers to record the lower-frequency coefficients except the most important one共the DC value兲. The DC value of each block is regarded as the secret key and shared among the n participants by applying the共r, n兲 threshold scheme. Though it is a frequency domain method, Ref.13cannot progressively display the image; moreover, the sequence of random numbers, which records the AC lower-frequency coefficients of the secret image, must be stored elsewhere carefully.

Below we review Ref. 6 in particular, for our method utilizes its sharing polynomials. In Ref.6, a secret image O containing m pixels is shared by n participants using a polynomial of module base 251. The details are as follows. The image O is first permuted to a noisy image Q. Then, Q is divided into m/r nonoverlapping sections so that each section contains r pixels. Let q共x兲 be the xth shadow image and qj共x兲 be the jth pixel in q共x兲, where 1ⱕxⱕn and 1

ⱕ jⱕm/r. For each section j, define its sharing polynomial

qj共x兲 = a0+ a1x + ¯ + ar−1xr−1 共mod 251兲, 共1兲

whose r coefficients a₀, a₁, . . . , a_r−1are the gray values of the r pixels in section j. The xth shadow image q共x兲 is the collection 兵qj共x兲兩 j=1,2, ... ,m/r其. Since each section j,

which has r pixels, contributes only one pixel qj共x兲 to the xth shadow image, the size of each generated shadow

im-age is only 1/r that of the secret image O. This property holds for every shadow image, i.e., for every x

苸兵1,2,3, ... ,n其. Any r of the n shadow images can be utilized to reconstruct Q; for the inverse process to find the value of the r coefficients a0, a1, . . . , ar−1used in Eq. 共1兲

only needs r of the n values兵qj共1兲,qj共2兲, ... ,qj共n兲其. This is

a numerical interpolation problem, and the solution can be found using a linear combination of Lagrangian polynomi-als共see Refs.6or10or any numerical methods textbook兲. For example, if r = 3 and the three received values are 兵qj共2兲,qj共3兲,qj共5兲其, then qj共x兲 =

冋

qj共2兲共x − 3兲共x − 5兲 共2 − 3兲共2 − 5兲+ qj共3兲 共x − 2兲共x − 5兲 共3 − 2兲共3 − 5兲 + qj共5兲 共x − 2兲共x − 3兲 共5 − 2兲共5 − 3兲

册mod 251

.

All arithmetic operations in this equation, including divi-sion, are in the modulus sense, i.e., 1/y is the integer z satisfying that 1 =共yz兲_{mod 251}. For example, 1/6=42 be-cause 共6⫻42兲mod 251= 252mod 251= 1. Notably, module base

is 251 in Ref.6, for 251 is a prime very close to 256, and 256 is the number of gray levels in an image.

3 Encoding

As indicated in Fig. 1, the proposed progressive

image-sharing共PIS兲 method consists of 共1兲 quantization after the

discrete cosine transform共DCT兲, 共2兲 base-17 transform, 共3兲 band partition, 共4兲 sharing, 共5兲 combining shares, and 共6兲 data hiding. Before introducing the detail of these proce-dures in the subsections of this section, we first quickly glance at the algorithm.

3.1 Encoding Algorithm

Input: the given gray-value image.

Parameter settings: Let rL⬍rM⬍rHⱕn be four given

integers. Set the prime number p to the value p = 17共rather than the p = 251 used in Ref.6兲.

Output: n stego images. Steps:

1. Divide the image into nonoverlapping 8⫻8 blocks. 2. Then for each 8⫻8 block, do the following: • As in JPEG, subtract 128 from each gray value of the

block; then compute the discrete cosine transform 共DCT兲 values of the block; then quantize the DCT values by the quantization table on page 484 of Ref. 18共see Sec. 3.2兲; then arrange the 8⫻8 quantized val-ues in zigzag order.18

• According to Fig. 2, transform 共re-quantize兲 the fre-quency values to numerical base-17 values 共Sec. 3.3兲. • According to Fig.2, divide the frequency values into 3 frequency bands, i.e., low, middle, and high共Sec. 3.4兲. • Share each band according its own threshold value.

The products are called shares 共Sec. 3.5兲.

• Combine three shares 共low-, middle-, and high-frequency兲 into a “shadow” 共Sec. 3.6兲.

• At the corresponding block position, hide the n shad-ows in the n cover images. This creates a block, at the corresponding block position, in each of the n stego images共Sec. 3.7兲.

3. Store the n stego images in n distinct places; or trans-mit the n stego images by n distinct channels. 3.2 Quantization

In the frequency domain, there are 64 DCT coefficients for each 8⫻8 block. In order to reduce the shadow size, it is essential to quantize the frequency values to reduce the amount of data. The standard quantization table described on page 484 of Ref.18is used for quantization.

3.3 Base-17 Transform

Because our sharing scheme utilizes a mod-17 operation, each digit must be in the 0–16 range. For this reason, it is necessary to transform the numeric base of the frequency values. In other words, each 共quantized兲 frequency value must be transformed to a base-17 number so that each digit is in the 0–16 range and thus becomes more suitable for our mod-17 sharing scheme. Below is the algorithm for the base-17 transform of each coefficient.

3.3.1 Algorithm for the Base-17 transform

Input: an integer frequency value fv.

Output: a new integer in which each digit is in the range 0–16.

Steps:

1. According to Fig.2, obtain the integer nu共the number

of digits needed兲 at the corresponding coefficient po-sition. For example, nu= 3 if fvis the DC coefficient.

2 Compute

s =
17nu/2, 共2兲

which is called the shift level.

3. Transform the shifted value s + fv into an nu-digit

number whose radix共numeric base兲 is 17.

In the algorithm, the role of s is to adjust the frequency value to its positive version so that subsequent operations can be easier.

3.4 Band Partition

There are three threshold values兵rL, rM, and rH其. The

small-est threshold value is rL共the low-frequency threshold兲, and

the largest threshold value is rH共the high-frequency

thresh-old兲. Note that low frequency represents the rough sketch of the image; hence, just a small number of shadows 共rL

shadows兲 should be eligible to reconstruct a blurred view of the image. This explains why rLshould be the smallest of

the 3 thresholds. An analogous reason explains why the largest is rH.

As will be explained later in Sec. 3.5, due to the “threshold-times smaller” shrinkage property discussed in Ref. 6, each low-frequency share will be rL times smaller

than the data size of the low-frequency data before sharing. Similar arguments hold for the middle-frequency and high-frequency shares, with rL replaced by rM and rH,

respec-Fig. 1 The encoding flowchart.

Fig. 2 The band-partition table共“3” means that quantized coefficient

is re-expressed as a 3-digit number in the base-17 system, etc.兲. The darkest/gray/white region is the low-/middle-/high-frequency re-gion, respectively.

tively. This “threshold-times smaller” shrinkage property will be used in deciding how to partition the 64 frequency coefficients into 3 bands, as explained below.

Without loss of generality, assume that the three thresh-olds are rL= 3, rM= 4, and rH= 5. Then, in order to reduce

the total size of the joint shadow共which directly combines the low-frequency share, middle-frequency share, and high-frequency share兲, a general rule can be used: Before shar-ing, the total amount of low-frequency data should not con-tain too many digits 共because they will be reduced by 300%兲, while the total amount of high-frequency data can be less strict 共because they will be reduced by 500%兲. In other words, only a few of the 8⫻8=64 coefficients will be assigned to the low-frequency band, while most coefficients will be assigned to high-frequency band. Therefore, as shown in Fig. 2 and Table 1, there are only three low-frequency coefficients in the low-low-frequency band 共9=3 ⫻3 digits together for the low-frequency band, which con-tains only the three top-left coefficients, each which is of 3 digits兲. However, the middle-frequency band has eight middle-frequency coefficients 共each is two digits, so 16 = 2⫻8 digits together for the middle-frequency band兲. Fi-nally, the high-frequency band has all the remaining 64 − 3 − 8 = 53 coefficients. In other words, the high-frequency band has 25= 2⫻6+1⫻13+0⫻34 digits, for there are six 2-digit coefficients and, 13 1-digit coefficients, and the re-maining 34 bottom-right coefficients are neglected. Nota-bly, due to the abovementioned “threshold-times smaller” property, each shadow combining the low-, middle-, and

high-frequency shares will have 共9/3兲

+共16/4兲+共25/5兲=3+4+5=12 digits, although before shar-ing the total has 9 + 16+ 25= 50 digits.

In general, to partition the 8⫻8=64 frequency coeffi-cients into 3 bands, we may try to let the low-共or middle-, or high-兲 frequency band have approximately, or propor-tional to, r_L2digits共or r_M2 or r_H2, respectively兲. By doing this, more digits will go to high-frequency band, and thus reduce the size of the 3-bands-joint-shadow because the high-frequency share shrinks most. Notably, with this kind of partition, the joint shadow contains about 共r_L2/rL兲

+共r_M2 /rM兲+共rH 2_/r

H兲=rL+ rM+ rH digits, or 共rL+ rM

+ rH兲log217 bits, which is usually a value at least 2 times

smaller than共8⫻8兲log2256 bits, if rHⱕ20. This will make

it easy to hide the joint shadow in a cover image whose size

is identical to the given sensitive image, if the hiding method has a big hiding capacity rate not worse than 1:2 共the hiding capacity is the ratio between the size of the hidden data and the size of the cover image兲. If rHⱕ5, then

the cover image can even be 20/5=4=2⫻2 times smaller than the given image, as we will see in the experiment, because 共rL+ rM+ rH兲log217

ⱕ共5+5+5兲log217= 61.3⬍64=关共4⫻4兲log2256兴/2

indi-cates that the shadow of each 8⫻8 block can be hidden in a 4⫻4 block of the cover image, if the hiding method has a big hiding capacity rate not worse than 1:2.

3.5 Sharing

This section employs the format of the share-generating polynomial in Ref. 6 to share each frequency band of the given image. Assume that n is the number of shadows to be created and that r is one of the three thresholds兵rL, rM, rH其.

Split the base-17 data, which are taken from the frequency band 共the band corresponding to the threshold r兲 of an 8 ⫻8 block, into sectors of r digits each. Below we show how to share the r digits 兵a0, . . . , ar−1其 coming from one

sector. Assume that 0⬍rⱕn and 0ⱕai⬍17 for all ai. Let P共x兲 = a0+ a1x + a2x2+ ¯ + ar−1xr−1 共mod 17兲 共3兲

be the share-generating polynomial. For each k in the range 兵1, ... ,n其, the kth share receives the value P共k兲 as the share value corresponding to this sector. When all sectors and all blocks are shared, we have the n shares that we want. No-tably, each share receives only one value from each sector; so the number of values in a share is identical to the num-ber of sectors contained in the data. This is why each share is r times smaller than the data, for the number of sectors is

r times smaller than the data size.

This paper uses mod 17共rather than the mod 251 used in Ref. 6兲 because if the module base being used is 17, then later, when we hide a share value in a cover image using our hiding method,20the gray-value distortion at each pixel is at most
17/2=8 according to Ref. 20, which is about the limit of the gray-value distortion that human vision can tolerate at each pixel.

Table 1 The information distribution after the frequency-band partition.

Band The Thresholds for Sharing Zigzag Position in the 8_⫻8 DCT Coefficients

Number of Base-17 Digits Used in the Frequency Band PSNR of Reconstructed Lena Image PSNR of Reconstructed Boat Image Low frequency tL= 3 0–2 9 = 3⫻3 28.00 28.18 Middle frequency tM= 4 3–10 16= 2⫻8 32.64 32.83 High frequency t_H= 5 11–29and 30–63 25= 2_{⫻6+1⫻13+0⫻34} 37.04 37.64

3.6 Combining Shares

After generating the n shares for each frequency band, then, for each k = 1 , . . . , n, we directly combine the three 共low-, middle-, and high-frequency兲 kth shares to form the kth shadow, because a single shadow is more convenient for management and safekeeping than three shares 共each shadow holder only has to take and hold one shadow in-stead of three shares of different bands兲. In view of the distributed database, handling and managing one shadow is also much easier than doing so with three shares.

Notably, to increase the security level, we may use a key as the seed of a pseudo-random number generator19to gen-erate a sequence that is a rearrangement of the natural num-bers. Then, according to this generated sequence, we per-mute the blocks’ location or digits’ location, within each shadow. The seed of the pseudo-random number generator can depend on, rather than equal, the secret image’s total sum of gray values. The seed itself can be transformed to a base-17 number, and then its base-17 digits can also be shared and inserted in some prespecified scattered locations of the n shadows. The details are omitted here to save space. In any case, the seed can be recovered later when r of the n shadows are received.

3.7 Data Hiding

Each share, and hence, each shadow, looks noisy. The noise-like appearance often catches hacker’s attention. To prevent the shadow from being eye-catching, hiding each shadow in an ordinary gray-value image is suggested.20–24 The data-hiding procedure used here is the so-called modu-lar hiding method,20 which uses a modular operation to hide data in the least-significant bits of the cover pixels. The detailed algorithm is described in Ref.20. The distor-tion between the cover and stego image is guaranteed to be at most
17/2=8 at each pixel if the module base being used is 17. The reason can also be found in Ref.20. 4 Decoding_{„Reconstruction of the Image…} This section introduces the decoding phase that recon-structs the image when receiving enough shadows. In sum-mary, the image can be retrieved from any r共rⱖrL兲 of the n

stego images by using reverse operations. 4.1 Procedure for Reconstruction

Input: the received r共rⱖrL兲 stego images.

Output: the image that was shared and hidden in the stego-images.

Steps:

1. Extract the hidden data from the r collected stego images.

2. Divide directly each of the r hidden data sets into their 3 corresponding frequency shares.

3. Do inverse sharing band by band: if rⱖrH⬎rM⬎rL,

then do inverse-sharing on all three bands; if rH⬎r

ⱖrM⬎rL, then only on the middle and low bands; if rH⬎rM⬎rⱖrL, then only on the low band.

4. According to the 8⫻8 zigzag order, distribute the numbers obtained in step 3 to the 8⫻8 coefficient table 关according to the partition table 共Fig. 2兲兴. For

example, the first three digits are bound together and treated as a single coefficient, namely, the DC coef-ficient.

5. Scale back the quantized data according to the stan-dard quantization table on page 484 of Ref.18. 6. Do inverse DCT.

7. Add 128 to each pixel.

4.2 Convenient Version to Do Inverse Sharing

Below we discuss how to do step 3 above efficiently. In the image-sharing scheme 共see Sec. 3.5兲, the n shadows

P共1兲, P共2兲, ... , P共n兲 are generated by Eq.共3兲. In the decod-ing, after receiving r shadows, the r coefficients 兵a0, a1, . . . , ar−1其 of Eq.共3兲can be recovered by the matrix-vector multiplication method rather than by the Lagrangian

polynomials method used in Refs. 6 and10, which is less convenient.

Below we introduce this more convenient method for image reconstruction. The following equation shows the relationship between the r-dimensional data aជ and the

n-dimensional share values S៝in Eq.共3兲:

冤

1 1 1 . . . 1 1 2 22 . . . 2r−1 . . . ] 1 n n2 _{. . . n}r−1

冥

•

冤

a0 a₁ . . . a_r−1

冥

=

冤

P共1兲 P共2兲 . . . P共n兲

冥

. 共4兲

Let the r⫻r generating matrix G be the matrix whose rows correspond to a received participant i and are of the form 1 , i , i2_{, . . . , i}r−1_{. The relationship among G,}

aជ=

冤

a0 a₁ . . . ar−1

冥

, and s៝=

冤

P共i1兲 P共i₂兲 . . . P共ir兲

冥

is that Gaជ= sជ. Here, i1, i2, . . . , ir are the r received shares.

Therefore, a៝= G−1_{s៝, where G}−1_{can be evaluated just once,}

for G−1 is identical between data sectors of r digits each. Then, because G−1 _{is known, the r-digit data aជ for each} r-digit sector can be obtained quickly by a៝= G−1_{s៝, because}

it is just a multiplication between a fixed r⫻r matrix G−1 and an incoming r⫻1 vector s៝. When we have received r shares, as many r-dimensional vectorss៝keep on coming in 共they are extracted sequentially from the r received shares兲, we obtain a lot of r-digit data a៝ sequentially.

For example, assume that r = rL= 3 and the collected

shadows are Shadows 2, 3, and 5. Below we show how to reconstruct the low-frequency data. The generating matrix

G = GL=

冤

1 2 4 1 3 9 1 5 8

冥

, where 8 =共52兲 mod 17 = 25 mod 17, aជ=

冤

a₀ a1 a2

冥

, and sជ=

冤

P共2兲 P共3兲 P共5兲

冥

.

First, evaluate and obtain

G−1=

冤

5 12 1 3 12 2

6 8 3

冥

.

Then, for t = 2 , 3, and 5, grab the first digit from the low-frequency band of Share t, and call it P共t兲. So we have the

s

ជ=关P共2兲, P共3兲, P共5兲兴transpose for Sector 1. Then evaluate aជ = G−1sជto obtain the 3-digit data aជ for Sector 1. Then, for

t = 2, 3, and 5, grab the next not-yet-processed digit from

the low-frequency band of Share t, and still call it P共t兲. So we have the sជfor Sector 2. Then evaluate aជ= G−1sជ, which is the 3-digit data for Sector 2. Repeat this process until all digits from the low-frequency band of the three received shares are processed. Note that the 3⫻3 matrix G−1 _is

never changed in the whole inverse-sharing process for the low-frequency band. As a remark, for a 512⫻512 impor-tant image, there are 512⫻512/共8⫻8兲=4,096 image blocks, and each block has 3 + 3 + 3 = 9 low-frequency digits according to Fig. 2. Thus, there are 4,096⫻9/3=12,288 three-digit data sectors. So, compared with the time it takes to do matrix-vector multiplication 12,288 times, the time it takes to the 3⫻3 matrix G−1just once can be neglected.

Later, when we obtain one more shadow, for example, Shadow 6, and assume that rM= 4, then we can construct a

4⫻4 matrix G=GMand obtain its inverse matrix G−1. Then

we can use an analogous inverse-sharing process to obtain middle-frequency data that were partitioned earlier as a se-quence of four-digit sectors. The remaining details are omitted to save space.

5 Experimental Results and Security Analysis of Shadows

5.1 Experimental Results

In the experiments, the standard quantization table on page 484 of Ref. 18is adopted, and the low-共rL兲, middle-共rM兲,

and high-共rH兲 frequency thresholds are set to 3, 4, and 5,

respectively. Therefore, the low-, middle-, or high-frequency threshold can be reconstructed whenever any 3, 4, or 5 shadows are received, respectively. The parameter n is set to 6, i.e., there are 6 shadows or 6 stego images. The value of the variable quality required in JPEG compression software is set to 85 in the experiments. The frequency partition and its relative information are as in Table1. The partition table appears in Fig.2, where each number at each cell of the 8-by-8 grid represents the number of digits used to represent that coefficient when the numeric base is 17.

In the first experiment, the target image that the sender really wishes to send is the Lena image shown in Fig.3共a兲; and Fig.3共b1–b6兲 display the six cover images that will be modified slightly to cover Lena. Notably, Lena is 512

⫻512, but each cover image is only 256⫻256, as ex-plained below. According to the frequency partition infor-mation shown in Table1, and as discussed in Sec. 3.4, the total number of generated digits in each 8⫻8 block of the joint shadow is

9/3 + 16/4 + 25/5 = 3 + 4 + 5 = 12

共each digit is an integer in the range 0–16兲. Since each digit in the range 0–16 can be hidden in an 8-bit gray-value pixel

of the cover image, and also since

关共8⫻8兲:12兴=关5.33:1兴⬎关4:1兴, the size of each cover im-age is chosen to be 4 = 2⫻2 times smaller than the original image.

The data-hiding method being used in Sec. 3.7 is the modular LSB method20with a slight modification discussed in Ref. 25共the details are omitted because this is not the key point of this paper兲. Fig.4shows the stego images. The qualities of all stego images and reconstructed images are measured by the peak-signal-to-noise ratio共PSNR兲 defined as

PSNR = 10⫻ log10

2552

MSE, 共5兲

in which the MSE denotes the mean square error between the pixel values of the cover and of the stego images. Table 2 lists the PSNRs 共the measure unit is dB兲 to gauge the similarity 共from 0 dB to ⬁ dB兲 between the cover images 关Figs.3共b1兲–共b6兲兴 and stego images 关Figs.4共b1

*

兲–共b6

*

兲兴. The information about the low, middle, and high fre-quencies can be retrieved by collecting, respectively, “any” three, four, and five of the six 256⫻256 stego images shown in Fig.4. The corresponding reconstructed versions are shown in Fig. 5. The PSNRs of the reconstructed 512 ⫻512 Lena image are, respectively, 28.00, 32.67, and 37.04 dB. The experimental results indicate that the recon-structed version from any rL= 3 collected shadows can

re-veal a rough sketch, while that from any rH= 5 collected

shadows can show great details of the image. Note that the total size of any rL= 3 stego images is only 3⫻256

⫻256/512⫻512=75% of the 512⫻512 Lena, image, and that 75% can even be reduced to

关共rL⫻ 12兲/共8 ⫻ 8兲兴 ⫻ 关log 17/log 256兴 = 关rL⫻ 12/64兴

⫻ 关0.511兴 = rL⫻ 9.58 % = 28.74%

if we did not mind transmitting noise-like shadow images rather than transmitting ordinary-looking stego images. A similar argument holds if 75% 共28.74%兲 is replaced with 100% 共38.33%兲 and 125% 共47.91%兲, respectively, for the total size of the rM= 4 stego images关to get Fig. 5共b兲兴 and rH= 5 stego images关to get Fig.5共c兲兴.

As a comparison, note that our with-hiding 共without-hiding兲 sequence 兵75%共28.74%兲; 100% 共38.33%兲; and 125%共47.91%兲其 would have become 兵150%共75%兲; 200%共100%兲; and 250%共125%兲其 if the method in Ref.14 were used with the same settings: rL= 3, rM= 4, rH= 5.

Therefore, compared to Ref.14, our sizes are smaller, the transmission time can be shorter, and hence, we are more likely to succeed in an unstable/unfriendly environment. Similarly, compared to Ref.6, each member of the current

without-hiding total-space sequence 兵28.74%, 38.33%, 47.91%其 is also much shorter than the without-hiding total-space r⫻共1/r兲=1=100% listed in Ref. 6 when people want to view the secret image.

In the second experiment, the target Lena image is re-placed with the 512⫻512 image Boat shown in Fig. 6共a兲. The six obtained 256⫻256 stego images, shown in Figs. 6共b1’兲–共b6’兲, are still of good quality. The recovered ver-sions of Boat are in Fig.7. Note that the name of the boat can be recognized after rM= 4 or rH= 5 out of the 6

gener-ated shadow images are received 关see Fig. 7共b兲 and7共c兲兴, but not if rL= 3 shadows are received.

5.2 Security Analysis of Shadows

An encryption scheme should be robust against attacks such as statistical attack and differential attack.26–28 In the following paragraphs, we discuss these topics.

5.2.1 Statistical analysis (histogram and correlation)

To test the robustness of our shadows against statistical attacks, we inspect the histograms of the shadows and the correlations of two adjacent elements in the shadows.

In the histograms analysis of a shadow, we count the occurring frequency of each values. Since the proposed method uses mod 17 to obtain a value for each shadow element共i.e., shadow pixel兲, the value of each shadow ele-ment is between 0 and 16. Figure8 shows an example of our experiment about histograms analysis. Figure 8共a1兲 is the histogram of the 512⫻512 secret image Lena. Figures 8共b1兲–共b6兲 are the histograms of the six generated shadows for Lena. From Fig.8, we can see that the histograms of the shadows have close to a uniform distribution. A similar observation also holds for the histograms of the six gener-ated shadows for the secret image Boat. Although the two secret images have very distinct histograms, their shadows’ histograms almost all appear to have a uniform distribution.

Fig. 3 _{共a兲 The original Lena image of size 512⫻512. 共b1兲–共b6兲 The six 256⫻256 cover images}

In other words, the histogram of each shadow provides no clue about the secret image used to generate this shadow.

In addition to histogram analysis, we also analyze the correlation between two vertically adjacent pixels 共ele-ments兲, two horizontally adjacent pixels 共elements兲, and two diagonally adjacent pixels共elements兲 of the secret im-age 共shadow, respectively兲. The procedure is as follows: Each time, randomly select 1,000 pairs of two adjacent pix-els共or elements兲 from an image 共or shadow兲. Then calcu-late their correlation coefficient using the following two formulas:

cov共x,y兲 = E共x − E共x兲兲共y − E共y兲兲, 共6兲

rxy=

_冑

cov共x,y兲

D共x兲

冑

D共y兲, 共7兲

where x and y are the gray values of two adjacent pixels in the image 共or two adjacent elements in the shadow兲. In

numerical computations, the discrete formulas being used become E共x兲 = 1 N

兺

_i=1 N xi, 共8兲 D共x兲 = 1 N

兺

_i=1 N 共xi− E共x兲兲2, 共9兲 cov共x,y兲 = 1 N

兺

_i=1 N 共xi− E共x兲兲共yi− E共y兲兲. 共10兲

Table3shows the correlation coefficient rxyof two adjacent

pixels of the secret image, or two adjacent elements of each shadow. The correlation coefficient of secret image is rxy

= 0.9875 in the horizontal direction, which implies high correlation among these adjacent pixels of the secret image. To the contrary, the correlation coefficient rxyof the

gener-ated shadows is between 0.0040 and 0.0092, which shows the low correlation between adjacent elements of the gen-erated shadows. A similar observation also holds for the vertical and diagonal directions.

5.2.2 Differential analysis

As quoted from Refs.26and27, the opponent may make a slight change such as modifying only one pixel of the secret image and then observing the result in the cipher image. In this way, he may be able to find a meaningful relationship between the secret image and the cipher image. If one mi-nor change in the secret image can cause a significant change in the cipher image, then this differential attack would become very inefficient and practically useless.

In general, to test the influence of a one-pixel change to the secret image, two commonly used measures are the

Fig. 4 The six 256⫻256 stego images after hiding.

Table 2 The PSNRs of the six stego images 关either Fig. 4 or Figs. 6共b1’兲–共b6’兲兴, as compared to the six cover images in

Figs.3共b1兲–共b6兲.

Six Stego Images to Recover the Hidden Image

The Hidden

Image Pepper Jet Kiel Lake Baboon Goldhill Experiment 1

共Lena兲 35.74 35.86 35.81 35.68 35.77 35.81 Experiment 2

number of pixels change rate共NPCR兲 and the unified aver-age changing intensity (UACI). Let C₁ and C₂ be two ci-pher images whose corresponding original images have only a one-pixel difference. Let C₁共i, j兲 and C₂共i, j兲 be the gray values of the pixels at position 共i,j兲 in C₁ and C₂, respectively. Define a binary array D with the same size as images C1 and C2. Then, D共i, j兲 is determined by

D共i, j兲 =

再

1 if C1共i, j兲 = C2共i, j兲,

0 otherwise. 共11兲

The NPCR is defined as

NPCR =

兺

i,j

D共i, j兲

W⫻ H ⫻ 100 % , 共12兲

where W and H are the width and height of C1or C2. The NPCR measures the percentage of “unchanged” pixels

be-tween these two images. The UACI is defined as

UACI = 1

W⫻ H

冋

兺

i,j

兩C1共i, j兲 − C2共i, j兲兩

255

册

⫻ 100 % , 共13兲

which measures the average intensity differences between the two images C1 and C2. Notably, in our method, since

the shadow values are in the range 0–16 rather than 0–255, the denominator 255 should be replaced by 16, i.e., UACI

⬘

= 1

W⫻ H

冋

兺

i,j

兩C1共i, j兲 − C2共i, j兲兩

16

册

⫻ 100 % . 共14兲

Our NPCR values are between 18.23% and 18.78%, with the average NPCR being 18.52%. It means that, on average, about 100% −18.52% = 81.48% of the elements are changed per shadow, although the secret image only changes by one pixel. Our UACI

⬘

values are between 38.11% and 38.87%, with the average UACI

⬘

being 38.48%. It means that, on average, each shadow value 共whose range is 0–16兲 changes about 16⫻38.48% =6 in magnitude. With the obtained results for NPCR and UACI

⬘

, we can see that our shadows are very sensitive to small changes to the secret image共secret image changes of only

Fig. 5 The reconstructed Lena image of共a兲 low, 共b兲 low+middle, and 共c兲 low+middle+high

frequen-cies. The PSNRs are 28.00, 32.64, and 37.04 dB, respectively. Note that_{共a兲 is from any 3 of the 6} images in Fig.4;共b兲 is from any 4; and 共c兲 is from any 5.

one pixel兲. Therefore, our shadows are also robust against the differential attack.

6 Comparisons with Ref.6

The procedure detailed in Ref.6has no progressive ability. In fact, the two papers are for two distinct groups of cus-tomers. Ref.6is for people transmitting top-secret images, while the current paper is for people who need to transmit an image from unstable channels, or for a company whose images are a bit confidential共but not top-secret兲 and need to be processed on a daily basis by employees of different ranks at different security levels. As a result, there are at least the following two progressive applications of the cur-rent paper that cannot be done by Ref. 6: Application 1, used in a company’s daily meeting 共see paragraph 3 of Section 1兲; and Application 2, to transmit an image in an

unstable, long-delay environment共see paragraph 4 of Sec-tion 1兲.

Shadows in the current paper have a more economic size and, hence, more chances to survive in the recovery meet-ing if communication channels are stable for only a short period of time. In fact, as discussed in the fifth paragraph of Section 5, to view the secret image, the total size of the noisy shadows is 28.74%, 38.33%, or 47.91% here for the

rL= 3, rM= 4, or rH= 5 example, respectively, which is much

smaller than the without-hiding total space r⫻共1/r兲=1 = 100% needed in Ref.6.

Note that the current paper is not just a simple extension of Ref.6. All we used from Ref.6 is the share-generating polynomial 关Eq. 共3兲, modified from Eq. 共1兲兴; besides this equation, Ref. 6 has no DCT, no mod-17 transform, no

Fig. 6 共a兲 The original Boat image of size 512⫻512. 共b1⬘兲–共b6⬘兲 The six corresponding 256⫻256

band partition table 共Fig. 2 and Table 1兲, and no joint shares. All these components are needed to build up the current progressive method.

A more convenient version to do inverse sharing is also inserted in Sec. 4. It bypasses the Lagrangian polynomials approach used in Ref.6, instead using a direct multiplica-tion approach that is easier to implement.

7 Conclusions

We propose a sharing method to recover an image progres-sively, which can also be utilized to transmit an image from an unstable/unfriendly environment. The transmission of an image uses n stego images that each hides a shadow. The n smaller-size stego images can be transmitted or hidden us-ing n distinct channels to increase the survival rate, and the recovery only cares about the question, “How many stego images have arrived?” rather than the question, “Which stego images have arrived?”

In the encoding, the spatial domain is transformed into the frequency domain by DCT. The 8⫻8=64 frequency coefficients of each 8⫻8 block are partitioned into three bands共low, middle, and high兲. The three bands are shared separately, and each band generates n shares. The 3n gen-erated bands are merged to get n shadows, and each

shadow contains information from all three bands. Each of the n shadows looks noisy and is hidden in an ordinary-looking cover image to reduce the chance of being at-tacked. For each pixel, the gray-value difference between the cover image and the stego image is at most 8; hence, the stego images have no visible artifact after hiding the shadows.

In the decoding, when the receiver receives rLof the n

shares, a low-resolution version of the given image can be reconstructed. When rM of the n shares are received, a

middle-resolution version can be reconstructed. Finally, when rH of the n shares are received, a high-resolution

version can be reconstructed. Note that if a user would like to use more thresholds, for example, four thresholds, then he can partition the 64 frequency coefficients into four bands, rather than the three bands used in this paper. It is not hard to do this modification from the information in Section 3.4 and Fig.2; the details are omitted to save space. The experiments show that the stego images共with shad-ows hidden in them兲 are of acceptable quality 关see Fig. 4 and Figs.6共b1’兲–共b6’兲兴, and they reduce the chance to at-tract attackers’ attention. In the progressive display, the re-constructed version from rLcollected stego images can

re-veal a rough sketch关see Fig.5共a兲and Fig.7共a兲兴; and then

Fig. 7 The reconstructed Boat image of共a兲 low, 共b兲 low+middle, and 共c兲 low+middle+high

frequen-cies. The PSNRs are 28.18, 32.83, and 37.64 dB, respectively. Note that_{共a兲 is from any 3 of the 6} images in Fig.6共b1’兲–共b6’兲; 共b兲 is from any 4; and 共c兲 is from any 5.

the details appear关see Fig.5共b兲and5共c兲and Fig.7共b兲and 7共c兲兴 as rM or rHstego images become available.

Further-more, the size of each stego image is much smaller than the given image共for example, 1:4兲, so the waiting time to

re-ceive a sufficient number of stego images will not be too long when the n stego images are sent from n distinct chan-nels. This smaller-size property also increases the survival rate when the sending channels are in an unstable/

Fig. 8 Histogram analysis._{共a1兲–共a2兲 are, respectively, the histograms of the 512⫻512 secret images}

Lena and Boat in Fig.3共a兲and Fig.6共a兲.共b1兲–共b6兲 are the histograms of Lena’s six generated shad-ows._{共The six histograms of Boat’s generated shadows also look like they have a uniform distribution.兲}

unfriendly environment, because each channel will not be take too long. Notably, a lossless recovery version is also possible if we allow the stego images to have a larger size. This lossless adaptation, if needed, can be done through using lossless compression to replace the first part of step 2 in the encoding algorithm.

As a final remark, the proposed method has several no-table attributes:共1兲 It is missing-allowable 共allowing up to

n − rL stego images get lost兲; 共2兲 the shadows are equally

important, so there is no need to worry about which part is lost or transmitted first;共3兲 the method is secure 共intercept-ing fewer than rL stego images cannot reveal the given

image兲; 共4兲 progressive viewing, is allowed; 共5兲 it has im-proved inverse sharing by skipping the Lagrangian polyno-mials approach;共6兲 the shadow size is much smaller than those in Ref.14; hence, it is more likely to succeed when being transmitted from an unstable/unfriendly environment in which none of the existing channels is reliable for a long period, and the moment when a channel becomes blocked is totally unpredictable; and 共7兲 as discussed in Sec. 5, to view the secret image, the total size of the noisy shadows needed is 28.74%, or 38.33%, or 47.91%; which is also much shorter than the without-hiding total size r⫻共1/r兲 = 1 = 100% needed in Ref.6.

Acknowledgments

This work was supported by the National Science Council of the Republic of China, under Grant NSC962221-E-009-039. The authors would like to thank the editor and the two reviewers for their valuable suggestions.

References

1. Nation Bureau of Standards, “Data Encryption Standard,” Federal Information Processing Standards Publication 46 U.S. Government Printing Office, Washington, DC共1977兲.

2. R. L. Rivest, A. Shamir, and L. Adleman, “A method for obtaining digital signatures and public key cryptosystems,” Comm. Assoc.

Comput. Mach. 21, 120–126共1978兲.

3. A. Shamir, “How to share a secret,”Commun. ACM22共11兲, 612–613

共1979兲.

4. G. R. Blakley, “Safeguarding cryptographic keys,” in Proc. AFIPS

1979 National Computer Conference, 48, 313–317共1979兲.

5. M. Naor and A. Shamir, “Visual cryptography,” Advances in Cryptography—EUROCRYPT ’94, Lect. Notes Comput. Sci. 950, 1–12共1995兲.

6. C. C. Thien and J. C. Lin, “Secret image sharing,”Comput. Graphics

26共5兲, 765–770 共2002兲.

7. A. Benazza-Benyahia and J.-C. Pesquet, “A unifying framework for lossless and progressive image coding,” Pattern Recogn. 35共3兲, 627– 638共2002兲.

8. K. L. Chung and S. Y. Tseng, “New progressive image transmission based on quadtree and shading approach with resolution control,”

Pattern Recogn. Lett. 22共14兲, 1545–1555 共2001兲.

9. C. C. Chang, J. J. Jau, and T. S. Chen, “A fast reconstruction method for transmitting image progressively,”IEEE Trans. Consum. Elec-tron.44共4兲, 1225–1233 共1998兲.

10. C. C. Chang and R. J. Huang, “Sharing secret images using shadow codebooks,” Inf. Sci. (N.Y.) 111共1–4兲 335–345 共1998兲.

11. J. B. Feng, H. C. Wu, C. S. Tsai, and Y. P. Chu, “A new multi-secret images sharing scheme using Lagrange’s interpolation,” J. Syst.

Softw. 76共3兲, 327–339 共2005兲.

12. C. C. Thien and J. C. Lin, “An image-sharing method with user-friendly shadow images,”IEEE Trans. Circuits Syst. Video Technol.

13共12兲, 1161–1169 共2003兲.

13. C. C. Lin and W. H. Tsai, “Secret image sharing with capability of share data reduction,”Opt. Eng.42共8兲, 2340–2345 共2003兲.

14. S. K. Chen and J. C. Lin, “Fault-tolerant and progressive transmis-sion of images,” Pattern Recogn. 38共12兲, 2466–2471 共2005兲. 15. S. J. Lin and J. C. Lin, “VCPSS: A two-in-one two-decoding-options

image sharing method combining visual cryptography 共VC兲 and polynomial-style sharing共PSS兲 approaches,” Pattern Recogn. 40共12兲, 3652–3666共2007兲.

16. W. P. Fang and J. C. Lin, “Visual cryptography with extra ability of hiding confidential data,” J. Electron. Imaging 15共2兲, 0230201– 0230207共2006兲.

17. R. Z. Wang and S. J. Shyu, “Scalable secret image sharing,” Signal

Process. Image Commun. 22共4兲, 363–373 共2007兲.

18. R. C. Gonzalez and R. E. Woods, Digital Image Processing, 2nd edition, Addison-Wesley, Reading, MA共2002兲.

19. M. Matsumoto and T. Nishimura, “Mersenne twister: A 623-dimensionally equidistributed uniform pseudorandom number gen-erator,”ACM Trans. Model. Comput. Simul.8共1兲, 3–30 共1998兲.

20. C. C. Thien and J. C. Lin, “A simple and high hiding capacity method for hiding digit-by-digit data in images based on modulus function,”

Pattern Recogn.36共12兲, 2875–2881 共2003兲.

21. C. Y. Yang and J. C. Lin, “Image hiding by base-oriented algorithm,”

Opt. Eng.45共11兲, 117001–共1–10兲 共2006兲.

22. R. Z. Wang, C. F. Lin, and J. C. Lin, “Image hiding by optimal LSB substitution and genetic algorithm,”Pattern Recogn.34共3兲, 671–683

共2001兲.

23. D. C. Wu and W. H. Tsai, “Spatial-domain image hiding using image differencing,”IEE Proc. Vision Image Signal Process.147共1兲, 29–37

共2000兲.

24. Y. S. Wu, C. C. Thien, and J. C. Lin, “Sharing and hiding secret images with size constraint,” Pattern Recogn. 37共7兲, 1377–1385 共2004兲.

25. K. H. Hung, “Progressive image sharing,” MS thesis, Department of Computer and Information Science, National Chiao Tung University, Taiwan共2003兲.

26. G. Chen, Y. B. Mao, and C. K. Chui, “A symmetric image encryption scheme based on 3D chaotic cat maps,”Chaos, Solitons Fractals

21共3兲, 749–761 共2004兲.

27. H. El-din, H. Ahmed, H. M. Kalash, and O. S. Farag Allah, “Encryp-tion efficiency analysis and security evalua“Encryp-tion of RC6 block cipher for digital images,” Int. J. Comp., Inform., Syst. Sci. Eng. 1共1兲, 33–39 共2007兲.

28. H. El-din, H. Ahmed, H. M. Kalash, and O. S. Farag Allah, “Encryp-tion quality analysis of the RC5 block cipher algorithm for digital images,”Opt. Eng.45共10兲, 107003–共1–7兲 共2006兲.

Table 3 Correlation coefficients rxyof two adjacent pixels in secret image/shadows.

Each Shadow Image’s rxy

Direction of Adjacency Original Image’s rxy S1 S2 S3 S4 S5 S6 Horizontal 0.9875 0.0040 0.0079 0.0057 0.0092 0.0047 0.0074 Vertical 0.9781 0.0021 0.0036 0.0025 0.0048 0.0015 0.0041 Diagonal 0.9616 0.0033 0.0051 0.0034 0.0063 0.0032 0.0049

Kuo-Hsien Hung received his MS degree

in computer and information science from National Chiao Tung University, Taiwan, in 2003. His recent research interests include image processing and secret sharing. He is a member of the Phi-Tau-Phi Scholastic Honor Society.

Yu-Jie Chang received his MS degree in

computer and information science in 2001 from National Chiao Tung University, Tai-wan. He is now a PhD candidate in the Computer Science Department of National Chiao Tung University. His research inter-ests include digital watermarking, image processing, and pattern recognition.

Ja-Chen Lin received his BS degree in

computer science in 1977 and his MS de-gree in applied mathematics in 1979, both from National Chiao Tung University 共NCTU兲, Taiwan. In 1988, he received his PhD degree in mathematics from Purdue University, Indiana. From 1981 to 1982, he was an instructor at NCTU. From 1984 to 1988, he was a graduate instructor at Pur-due University. He joined the Department of Computer and Information Science at NCTU in August 1988 and became a professor there. His research interests include pattern recognition and image processing. He is a member of the Phi-Tau-Phi Scholastic Honor Society.